Con artists are fleecing Uber drivers

It was business as usual for an Uber driver who’d been picking up and dropping off riders in Los Angeles on a Wednesday afternoon in early June.

He’d
just accepted a new trip in Beverly Hills and was was driving to get
the passenger when he got a strange phone call. It was from San
Francisco’s 415 area code. The caller, with a heavy Spanish-sounding
accent, said he was from Uber.

“They tell me to pull over and
cancel the trip,” says the driver, 31, who asked us not to use his name.
“They tell me I need to verify my account. They sound very professional
and very poised and say things like, ‘We really appreciate how good a
job you’re doing for Uber.'”

The caller told him the passenger
requesting the trip was disabled, so Uber wanted to send an SUV instead
to accommodate a large service animal.

That sounded reasonable to
the driver, who’d been working for Uber for only two months. What he
didn’t know was that he’d just become the victim of an elaborate con job
that drained all of the money from his account by week’s end.

“When
you’re a new driver and you get a call like that, it’s hard to put on
your logic hat and say, ‘I’m just going to guess you’re a scam artist,'”
the driver says. “But recounting the story now, it’s very clear to me
that that was a red flag.”

Uber is no stranger to scams. Fraudsters have signed up as drivers to get fees on fake cancellations, and cheated passengers with bogus discount rides offered on messaging boards and chat rooms. It’s why Uber has started using machine-learning tools over the past year to weed out scammers. The company says it’s spotted and stopped hundreds of these frauds.

But this scam is different. Its specific purpose is to fleece drivers. CNET spoke to three victims of this scam: one happened nine months ago, another three weeks ago and the third occurred last week. All three victims tell similar stories.

Apparently the scam has hit thousands of ride-hail drivers, and millions of dollars have been diverted from their accounts, according to a lawsuit brought by the US Attorney’s Office in New York’s federal court last November.

An
Uber spokeswoman says the company has worked with law enforcement
officials to help track down and prosecute these scammers. She says Uber
has also increased protections and security measures on drivers’
accounts.

“Overall the effectiveness of these scams has
dramatically reduced since last year as a result of additional fraud
rules instituted by our security teams,” she says.

But Harry Campbell, an LA-based driver who runs the popular Rideshare Guy blog, disagrees.

“The
volume has increased on this, as opposed to decreased,” he says, based
on feedback he’s heard from drivers. Also, based on that feedback, he
says “Uber hasn’t done anything to warn drivers.”

The scam

On that Wednesday, the LA driver did what that caller told him to do.

He pulled over and canceled the trip.

The caller asked for his email. He gave it.

The caller asked for his Uber account password. He gave him that, too, after a brief hesitation.

Then
the caller said to tell him the confirmation code he’d be receiving
shortly via text. The driver told him the code once he got the text.
This was the two-factor authentication needed to get into the driver’s
Uber account.

“Nothing happened for the rest of the week,” the driver says. “I didn’t think anything of this again until Saturday.”

But in those following three days, the scammer had changed the driver’s account settings and waited for the perfect time to withdraw money. Uber automatically transfers drivers’ earnings to their bank accounts every Sunday. Some drivers cash out at the end of the day, while others just wait for Sunday.

“When
these people were able to get into my account, they would’ve seen my
transaction history,” the driver says. “They could’ve looked at it and
said, ‘Oh this guy isn’t going to cash out before Sunday.’ They seemed
pretty sophisticated. They seemed to understand how the system works.”

By Saturday night, his $653.88 in earnings from that week had been nabbed from his account.

Former Uber driver Tatasi Lauofo tells a nearly identical story. When he was driving for the company in the Bay Area about nine months ago, he got a call from someone saying they were from Uber. The caller was polite and professional, he says. And, unaware of the scam, he gave them all of his account information. By the week’s end, he was out nearly $1,000.

This fraud is simpler than it seems. And a couple of key elements about Uber make it possible.

When
passengers hail a ride with Uber, they see the name of the driver and
the car’s make, model and license number, and they get an anonymized
phone number to call the driver. All of this ensures passengers safely
connect with the right driver. But it also makes it possible for the
wrong people to see lots of information about drivers.

On top of that, riders’ phone numbers are also anonymized, so that the caller ID drivers see has a 415 area code. That’s the area code for Uber’s headquarters.

So how did the scammer know the LA driver was picking up a passenger
in Beverly Hills? Because he was the one who made the ride request. By
doing that he was able to get the driver’s name, call him and make up
the story about the disabled passenger and large service animal.

Uber says it started sending “phone prompts” and “periodic
communications” to drivers to warn them about these scams. The three
drivers we spoke to said they never received any communications about
this from Uber. Uber also says it’s done a lot to safeguard drivers’
accounts.

“Accounts are protected by two-factor authentication as
well as multiple security checkpoints when logging in or making account
changes,” the Uber spokeswoman says. This “protects against unauthorized
access or changes by scammers.”

But some con artists have found ways around these security measures, she adds.

“They’ve adopted these phishing techniques to trick drivers into making these changes on their behalf.”

The aftermath

That
Saturday night, the LA driver was home relaxing when he got an
unexpected text from Uber about his earnings. He opened the app and saw
that his weekly pay had been transferred to a debit card that wasn’t
his.

“I see the debit card number is not the four digits that I recognize,” he says. “Automatically I realize this is what happened on Wednesday.”

Besides the debit card number, the scammers also changed his phone
number, email and bank account number, and locked him out of his
account. He immediately called Uber and was told he had to wait until
Monday when he could talk to a representative in person at one of its
driver hubs.

“I just kinda stressed out and hoped they couldn’t get any more personal information from my account,” he says.

That
Monday, an Uber rep at the hub helped the driver set things right. The
rep said this scam had been popular in Los Angeles over the past few
months and that he shouldn’t have given the caller his information. He
said Uber would never ask for account details. The driver said that
since he was new to Uber and hadn’t heard of the scam, he hadn’t known
what to do.

Finally, after some convincing, Uber agreed to credit
the $653.88 back to his account as a “one-time repayment courtesy,”
according to an email seen by CNET.

Paul Valdez, another Los
Angeles-based Uber driver, was fortunate enough to find out he’d been
scammed before money was stolen from his account. As with the LA driver
and Lauofo, Valdez gave the scammer all of his information during the
call. But shortly after he hung up, he got a text from Uber saying it
detected illegal activity on his account.

“Thank god I could access my password,” Valdez says. “But Uber never
really addressed the fraud thing. … If they did send that word out,
drivers like me would be like, ‘Oh shoot, who’s this?’ when we got that
call.”

Lyft drivers have also been victims of this con, says Campbell, although it seems Uber is the preferred target. Lyft says it’s taken steps to thwart the scammers. Phone calls to Lyft drivers begin with a recorded message saying a passenger is calling, for instance, so that imposters can’t claim to be calling from headquarters.

“As soon as we became aware of these attempts we worked to
identify and prevent them in real time and took immediate action against
the perpetrating users,” a Lyft spokesman says. “We have communicated
to drivers about these scams and steps they can take to best recognize
them and protect themselves.”

That’s one thing the Uber drivers say they would appreciate, for sure.

“The
drivers feel all alone out there,” Campbell says. “There’s always going
to be scammers when there’s a financial transaction, but Uber can do a
lot more on this.”